diff --git a/.github/workflows/benchmark-cache-restore.yml b/.github/workflows/benchmark-cache-restore.yml
index 17e1da301..2dd4ea857 100644
--- a/.github/workflows/benchmark-cache-restore.yml
+++ b/.github/workflows/benchmark-cache-restore.yml
@@ -20,6 +20,9 @@ defaults:
   run:
     shell: bash
 
+# The baseline and candidate actions are intentionally loaded from runtime
+# checkouts of the user-supplied refs, which the self-repository (`$/`) syntax
+# cannot express, so those `uses: ./...` steps are exempt from that audit.
 jobs:
   warm-caches:
     name: Warm ${{ matrix.tool }} ${{ matrix.profile }} caches (${{ matrix.os }})
@@ -51,7 +54,7 @@ jobs:
       - name: Prepare benchmark inputs
         run: bash __tests__/benchmark-cache-restore.sh prepare "${{ matrix.tool }}" "${{ matrix.profile }}"
       - name: Prepare cache save
-        uses: ./candidate
+        uses: ./candidate # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
@@ -99,7 +102,7 @@ jobs:
         run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
       - name: Restore with baseline iteration 1
         id: baseline-1
-        uses: ./baseline
+        uses: ./baseline # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
@@ -117,7 +120,7 @@ jobs:
         run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
       - name: Restore with candidate iteration 1
         id: candidate-1
-        uses: ./candidate
+        uses: ./candidate # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
@@ -135,7 +138,7 @@ jobs:
         run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
       - name: Restore with candidate iteration 2
         id: candidate-2
-        uses: ./candidate
+        uses: ./candidate # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
@@ -153,7 +156,7 @@ jobs:
         run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
       - name: Restore with baseline iteration 2
         id: baseline-2
-        uses: ./baseline
+        uses: ./baseline # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
@@ -171,7 +174,7 @@ jobs:
         run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
       - name: Restore with baseline iteration 3
         id: baseline-3
-        uses: ./baseline
+        uses: ./baseline # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
@@ -189,7 +192,7 @@ jobs:
         run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
       - name: Restore with candidate iteration 3
         id: candidate-3
-        uses: ./candidate
+        uses: ./candidate # zizmor: ignore[self-repository]
         with:
           distribution: temurin
           java-version: '17'
diff --git a/.github/workflows/e2e-cache.yml b/.github/workflows/e2e-cache.yml
index 2a9fef541..b364cfdf5 100644
--- a/.github/workflows/e2e-cache.yml
+++ b/.github/workflows/e2e-cache.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for gradle
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -61,7 +61,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for gradle
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -85,7 +85,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for maven
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -112,7 +112,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for maven
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -140,7 +140,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for sbt
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -181,7 +181,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for sbt
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -211,7 +211,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for gradle
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -241,7 +241,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for gradle
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -266,7 +266,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for gradle
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -288,7 +288,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for maven
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -316,7 +316,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for maven
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -341,7 +341,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for maven
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -369,7 +369,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for sbt
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -411,7 +411,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for sbt
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -446,7 +446,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with the cache for sbt
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -472,7 +472,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with a custom Maven cache path
-        uses: ./
+        uses: $/
         with:
           distribution: 'temurin'
           java-version: '11'
@@ -498,7 +498,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run setup-java with a custom Maven cache path
-        uses: ./
+        uses: $/
         with:
           distribution: 'temurin'
           java-version: '11'
diff --git a/.github/workflows/e2e-local-file.yml b/.github/workflows/e2e-local-file.yml
index 657334ce0..b820fafae 100644
--- a/.github/workflows/e2e-local-file.yml
+++ b/.github/workflows/e2e-local-file.yml
@@ -43,7 +43,7 @@ jobs:
           (New-Object System.Net.WebClient).DownloadFile($downloadUrl, "$env:RUNNER_TEMP/$localFilename")
         shell: pwsh
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'jdkfile'
@@ -84,7 +84,7 @@ jobs:
           (New-Object System.Net.WebClient).DownloadFile($downloadUrl, "$env:RUNNER_TEMP/$localFilename")
         shell: pwsh
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'jdkfile'
diff --git a/.github/workflows/e2e-publishing.yml b/.github/workflows/e2e-publishing.yml
index 35c1596c3..ac32a17c6 100644
--- a/.github/workflows/e2e-publishing.yml
+++ b/.github/workflows/e2e-publishing.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           persist-credentials: false
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -87,7 +87,7 @@ jobs:
           New-Item -Path $xmlDirectory -ItemType Directory
           Set-Content -Path $xmlPath -Value "Fake_XML"
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -125,7 +125,7 @@ jobs:
           New-Item -Path $xmlDirectory -ItemType Directory
           Set-Content -Path $xmlPath -Value "Fake_XML"
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -158,7 +158,7 @@ jobs:
         with:
           persist-credentials: false
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: 'temurin'
@@ -223,7 +223,7 @@ jobs:
             throw "Could not prepare the Maven Help Plugin"
           }
       - name: Configure dependency and plugin repositories
-        uses: ./
+        uses: $/
         with:
           distribution: 'temurin'
           java-version: '21'
diff --git a/.github/workflows/e2e-smoke.yml b/.github/workflows/e2e-smoke.yml
index fed3adf72..ee1e45a70 100644
--- a/.github/workflows/e2e-smoke.yml
+++ b/.github/workflows/e2e-smoke.yml
@@ -71,7 +71,7 @@ jobs:
         with:
           persist-credentials: false
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
diff --git a/.github/workflows/e2e-versions.yml b/.github/workflows/e2e-versions.yml
index c08b5f08d..d4c9b056a 100644
--- a/.github/workflows/e2e-versions.yml
+++ b/.github/workflows/e2e-versions.yml
@@ -106,7 +106,7 @@ jobs:
         with:
           persist-credentials: false
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
@@ -128,7 +128,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java with forced download
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: '21'
@@ -157,7 +157,7 @@ jobs:
       - name: Install bash and GnuPG
         run: apk add --no-cache bash gnupg
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
@@ -207,7 +207,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
@@ -243,7 +243,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -280,7 +280,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -335,7 +335,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
@@ -361,7 +361,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java with signature verification
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
@@ -455,7 +455,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
@@ -485,7 +485,7 @@ jobs:
     steps:
       - *checkout_step
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -506,7 +506,7 @@ jobs:
       - name: Attempt unsupported setup
         id: unsupported-setup
         continue-on-error: true
-        uses: ./
+        uses: $/
         with:
           distribution: oracle
           java-version: '21'
@@ -535,7 +535,7 @@ jobs:
         shell: bash
         run: echo "java 17" > .tool-versions
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -565,7 +565,7 @@ jobs:
         shell: bash
         run: echo "java 11" > .tool-versions
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -594,7 +594,7 @@ jobs:
         shell: bash
         run: echo "java 17.0.10" > .tool-versions
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -626,7 +626,7 @@ jobs:
         shell: bash
         run: echo "java=17.0.10-tem" > .sdkmanrc
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           distribution: ${{ matrix.distribution }}
@@ -647,7 +647,7 @@ jobs:
           echo "java=26-tem" > .sdkmanrc
           touch build.gradle
       - name: setup-java
-        uses: ./
+        uses: $/
         id: setup-java
         with:
           java-version-file: .sdkmanrc
@@ -668,7 +668,7 @@ jobs:
     steps:
       - *checkout_step
       - name: Setup Java 17 as default
-        uses: ./
+        uses: $/
         id: setup-java-17
         with:
           distribution: 'temurin'
@@ -676,7 +676,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Setup Java 21 without setting as default
-        uses: ./
+        uses: $/
         id: setup-java-21
         with:
           distribution: 'temurin'